What Is a Dirty IP?

Every server on the internet has an IP address. There are only about 4.3 billion IPv4 addresses in total, so providers reuse them. When someone deletes a server, its IP goes back into a pool, and later a new customer receives it.

Security companies and email providers keep records of IP addresses that behave badly. If an address sent spam, attacked other servers, or hosted malware, it gets a low reputation score or is added to a blocklist. That record belongs to the address, not to the person who caused the problem. So when the IP moves to a new owner, the bad reputation often moves with it.

A dirty IP is an address with a bad reputation from past use.

• Spam. Sending bulk or unwanted email is the fastest way to get an IP listed.
• Attacks and scanning. Brute-force login attempts and port scans get reported, and the reports are tied to the source IP.
• Hacked servers. Many dirty IPs belong to owners who never knew their server was compromised. A weak SSH password is often enough for an attacker to take control and use the server for spam or attacks.
• Open proxies. A proxy or mail relay without authentication lets anyone send traffic through it, and all of that traffic looks like it comes from you.
• Bad neighbors in the same range. Some services block a whole range of addresses (for example, a /24 range of 256 IPs) when enough addresses in it misbehave. Your IP can be affected even if it has a clean history of its own.

Some services also treat all datacenter IP ranges with more suspicion than home internet connections. That is not a "dirty IP" in the strict sense, but the result looks the same to you.

Email. Mail servers check the sending IP against blocklists like Spamhaus before they accept a message. If your IP is listed, your mail is rejected or sent to spam, even when SPF, DKIM, and DMARC are set up correctly.

Outgoing requests. Services behind Cloudflare and similar protection systems may challenge or block requests from low-reputation IPs. This affects anything your server does on the web: API calls, webhooks, scraping, and package downloads from protected mirrors.

Access to your site. Some corporate firewalls and security tools block connections to IPs on threat lists. Visitors on those networks may not reach your site at all.

Third-party platforms. Payment providers, login systems, and some SaaS APIs rate-limit or block traffic from IPs with a bad record.

First, find your server's public IPv4 address:

curl -4 ifconfig.me

Then check it with a few reputation services. Each one uses different data, so check more than one:

• Spamhaus IP and Domain Reputation Checker
• AbuseIPDB
• MXToolbox Blacklist Check
• Cisco Talos Reputation Center

The best time to do this is right after you create a server, before you deploy anything or point a domain at it.

1. Confirm the IP is the cause. Try the same request or email from a different server or network. If it works there and fails from your server, the IP is the likely cause. If it fails everywhere, the problem is somewhere else (your configuration, DNS, or the service itself).

2. Make sure the problem is not coming from you. If the IP was clean when you started and became dirty later, your server may be compromised. Check for unknown network connections and failed login attempts:

sudo ss -tunp

sudo grep "Failed password" /var/log/auth.log | tail -n 20

(The second command works on Ubuntu. Other distributions store login logs in different places.) If you find something you did not start, fix the server first. A new IP will get dirty again if the cause is still running.

3. Request removal. Most blocklists have a removal form. Spamhaus, for example, lets you request delisting after you confirm the problem has stopped. Many lists also remove entries on their own after a period without new reports.

4. Get a different IP. When removal is slow or the IP has a long record, replacing it is often faster. On Doprax you can create a new VM, check its IP with the tools above, and delete the old one. Per-hour billing on ProVM means a test VM costs very little.

5. For email, fix the rest too. A clean IP is only one part of email delivery. Set up reverse DNS, SPF, DKIM, and DMARC for your domain. Also note that outbound port 25 is blocked by default on ProVM to prevent spam. If you run a legitimate mail server, you can request to have it opened.

• Use SSH keys and disable password login.
• Install security updates regularly.
• Never run a proxy or mail relay without authentication.
• Watch your outgoing traffic. A sudden jump often means something on the server is sending traffic you did not plan.

Your IP is part of your server's identity, so treat its reputation like any other part of your setup: check it early and protect it.

Create a VM on Doprax